@vegard Yes, that would miss the normal "review all the stable commits" process. If you think there is a mainline-only commit that needs to have a CVE, please let us know at the cve@k.o address and we can assign it then.

But better yet, backport the fix to stable and it all happens automatically for you :)